ClickOnce Trust Prompt Tampering

Status: test
Severity: medium
Log source: category registry_set, product windows
Author: @SerkinValery, Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.

Known false positives

Legitimate internal requirements.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry
Defense Impairment	`T1112` Modify Registry

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: ClickOnce Trust Prompt Tampering
id: ac9159cc-c364-4304-8f0a-d63fc1a0aabb
status: test
description: Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.
references:
    - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
    - https://learn.microsoft.com/en-us/visualstudio/deployment/how-to-configure-the-clickonce-trust-prompt-behavior
author: '@SerkinValery, Nasreddine Bencherchali (Nextron Systems)'
date: 2023-06-12
modified: 2023-08-17
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel\'
        TargetObject|endswith:
            - '\Internet'
            - '\LocalIntranet'
            - '\MyComputer'
            - '\TrustedSites'
            - '\UntrustedSites'
        Details: 'Enabled'
    condition: selection
falsepositives:
    - Legitimate internal requirements.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetObject|contains: '\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel\'
    TargetObject|endswith:
        - '\Internet'
        - '\LocalIntranet'
        - '\MyComputer'
        - '\TrustedSites'
        - '\UntrustedSites'
    Details: 'Enabled'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Details`	eq	`Enabled`	`field:"Details" kind:eq value:"Enabled"`
`TargetObject`	ends_with	`\Internet` `\LocalIntranet` `\MyComputer` `\TrustedSites` `\UntrustedSites`	`field:"TargetObject" kind:ends_with`
`TargetObject`	match	`\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel\`	`field:"TargetObject" kind:match value:"\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel\"`

ClickOnce Trust Prompt Tampering

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`